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Abstract 

We present the first formal mathematical presentation of the generalized Russian cards 
problem, and provide rigorous security definitions that capture both basic and extended versions 
of weak and perfect security notions. In the generalized Russian cards problem, three players, 
Alice, Bob, and Cathy, are dealt a deck of n cards, each given a, b, and c cards, respectively. 
The goal is for Alice and Bob to learn each other's hands via public communication, without 
Cathy learning the fate of any particular card. The basic idea is that Alice announces a set 
of possible hands she might hold, and Bob, using knowledge of his own hand, should be able 
to learn Alice's cards from this announcement, but Cathy should not. Using a combinatorial 
approach, we are able to give a nice characterization of informative strategies (i.e., strategies 
allowing Bob to learn Alice's hand), having optimal communication complexity, namely the 
set of possible hands Alice announces must be equivalent to a large set of t — (n,a, l)-designs, 
where t = a — c. We also provide some interesting necessary conditions for certain types of 
deals to be simultaneously informative and secure. That is, for deals satisfying c = a — d for 
some d > 2, where b > d — 1 and the strategy is assumed to satisfy a strong version of security 
(namely perfect (d — Insecurity), we show that a = d + 1 and hence c = 1. We also give a 
precise characterization of informative and perfectly (d — l)-secure deals of the form (d + 1, 6, 1) 
satisfying b > d — 1 involving d — (n, d + 1, l)-designs. 



1 Introduction 

Suppose X is a deck of n cards, and we have three participants, Alice, Bob and Cathy. Let 
a + b + c = n and suppose that Alice is dealt a hand of a cards, Bob is dealt a hand of b cards and 
Cathy is dealt a hand of c cards. These hands are random and dealt by some entity external to the 
scheme. We denote Alice's hand by Ha, Bob's hand by Hb and Cathy's hand by He- Of course it 
must be the case that Ha U Hb U Hq = X. We refer to this as an (a, b, c)-deal of the cards. 

For a positive integer t, let (^) denote the set of (") i-subsets of X. An announcement by 
Alice A is a subset of ( ). It is required that when Alice makes an announcement A, the hand 
she holds is one of the a-subsets in A. The goal of the scheme is that, after a deal has taken place 
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and Alice has made an announcement, Bob should be able to determine Alice's hand, but Cathy 
should not be able to determine if Alice holds any particular card not held by Cathy. These notions 
will be formalized as we proceed. We remark that we focus on the scenario of Bob learning Alice's 
hand, although the original version of this problem is for Bob and Alice to learn each other's hand. 
We omit the latter case, since for any protocol whereby Bob may learn Alice's hand, Bob may 
then announce Cathy's hand publicly. This second step provides sufficient information for Alice to 
determine Bob's hand, without giving Cathy any more information than she previously had. 

This problem was first introduced in the case (a, b, c) = (3, 3, 1) in the 2000 Moscow Mathematics 
Olympiad. Since then, there have been numerous papers investigating the problem (called the 
Russian cards problem) and generalizations of it. Some are interested in card deal protocols that 
allow players to agree on a common secret without a given eavesdropper being able to determine 
this secret value. This area of research is especially interesting in terms of possible applications to 
key generation; see, for example p~0l HH E21 [13j HH H7J HSJ |2] . Others are concerned with analyzing 
variations of the problem using epistemic logic |18|. fT9j [201 [7]. Duan and Yang [9] and He and 
Duan [15] consider a special generalization, with n — 1 players each dealt n cards, and one player 
(the intruder) dealt one card; the authors give an algorithm by which a dealer, acting as a trusted 
third party, can construct announcements for each player. Recently, there have been some papers 
that take a combinatorial approach [HEH2JH], which we discuss in some detail in Section [5j 

We take a combinatorial point of view motivated by cryptographic considerations. To be spe- 
cific, we provide definitions based on security conditions in the unconditionally secure framework, 
phrased in terms of probability distributions regarding information available to the various players 
(analogous to Shannon's definitions relating to perfect secrecy of a cryptosystem) . In particular, we 
provide a formal mathematical presentation of the generalized Russian cards problem. We intro- 
duce rigorous mathematical definitions of security, which in turn allows for systematic and thorough 
analysis of proposed protocols. We then give necessary conditions and provide constructions for 
schemes that satisfy the relevant definitions. Here there is a natural interplay with combinatorics. 

1.1 Overview of Contributions 

The main contributions of our work are as follows: 

• We provide a formal mathematical presentation of the generalized Russian Cards problem. 
In particular, we define an announcement strategy for Alice, which designates a probability 
distribution on a fixed set of possible announcements A\,A2,--- ,~A. m Alice can make. In 
keeping with standard practice in cryptography (i.e., Kerckhoff's principle), we assume that 
Alice's announcement strategy is public knowledge. Security through obscurity is not consid- 
ered an effective security method, as secrets are difficult to keep; providing security under the 
assumption the adversary has full knowledge of the set-up of the given scheme is therefore 
the goal. This allows us to define the communication complexity of the protocol to be log 2 m 
bits, since Alice need only broadcast the index i of her chosen announcement, which is an 
integer between 1 and m. In order to minimize the communication complexity of the scheme, 
our goal will be to minimize m, the number of possible announcements. 

• We distinguish between deterministic strategies, in which the hand Ha held by Alice uniquely 
determines the index i that she will broadcast, and non-deterministic, possibly even biased 
announcement strategies. We are especially interested in strategies with uniform probability 
distributions, which we will refer to as equitable. 
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• We examine necessary and sufficient conditions for a strategy to be informative for Bob, i.e. 
strategies that allow Bob to determine Alice's hand. In particular, we give a lower bound on 
the communication complexity m for informative strategies and provide a nice combinatorial 
characterization of strategies that meet this bound, which we term optimal strategies. 

• We provide the first formal security definitions that account for both weak and perfect security 
in an unconditionally secure framework. We remark that current literature focuses on weak 
security. In addition, we provide simpler, but equivalent combinatorial security conditions 
that apply when Alice's strategy is equitable. Here weak and perfect security are defined 
with respect to individual cards. If a scheme satisfies weak security (which we will term weak 
1-security), Cathy should not be able to say whether a given card is held by Alice or Bob; if a 
scheme satisfies perfect security (which we will term perfect 1-security), each card is equally 
likely to be held by Alice. 

• We use constructions and results from the field of combinatorial designs to explore strategies 
that are simultaneously informative and perfectly secure; this is especially useful for the case 
c = 1. In particular, we analyze the case c = a — 2 in detail, and show that strategies for 
(a, b, a — 2)-deals that are simultaneously informative and perfectly secure must satisfy c = 1. 
We also show a precise characterization between Steiner triple systems and (3,n — 4, l)-deals. 

• We generalize our notions of weak and perfect security, which focus on the probability that 
individual cards are held by Alice, and consider instead the probability that a given set of 
cards (of cardinality less than or equal to a) is held by Alice. We consider deals satisfying 
c = a — d and achieve parallel results to the c = a — 2 case. 

1.2 Preliminary Notation and Examples 

Alice will choose a set of announcements, say Ai, Ai, . . . , A m such that every Ha G ( X ) is in at least 
one of the m announcements. For Ha G [ X ), define g{HA) = {i ■ Ha G Ai}. Alice's announcement 
strategy, or more simply, strategy, consists of a probability distribution pn A on g(HA), for every 
Ha G { X ) ■ The set of announcements and probability distributions are fixed ahead of time and they 
are public knowledge. We will use the phrase (a, b, c)- strategy to denote a strategy for an (a, b, c)- 
deal. In addition, we will assume without loss of generality that PH A (i) > for all i G g{HA)- To 
see this, note that if PH A (i) = for some Ha G (^) and i G g{HA), this means Alice will never 
choose Ai when she holds Ha- But since the set of announcements and probability distributions 
are public knowledge, Cathy also knows this, so there is no reason to have included Ha in the 
announcement Ai- 

When Alice is dealt a hand Ha G ( X ), she randomly chooses an index i G g{HA) according 
to the probability distribution pn A - Alice broadcasts the integer i to specify her announcement 
Ai. Because the set of announcements and probability distributions are fixed and public, the only 
information that is broadcast by Alice is the index i, which is an integer between 1 and m. Therefore 
we define the communication complexity of the protocol to be log 2 m bits. In order to minimize the 
communication complexity of the scheme, our goal will be to minimize m, the number of possible 
announcements. 

If \g(HA)\ = 1 for every Ha, then we have a deterministic scheme, because the hand Ha held 
by Alice uniquely determines the index i that she will broadcast. That is to say, in a deterministic 
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1 


{0, 1, 3}, {1, 2, 4}, {2, 3, 5}, {3, 4, 6}, {0, 4, 5}, {1, 5, 6}, {0, 2, 6} 


2 


{0, 2, 3}, {1, 3, 4}, {2, 4, 5}, {3, 5, 6}, {0, 4, 6}, {0, 1, 5}, {1, 2, 6} 


3 


{0, 2, 4}, {0, 3, 5), {1, 2, 3}, {0, 1, 6}, {1,4, 5}, {2, 5, 6} 


4 


{0, 1, 2}, {2, 3, 4}, {4, 5, 6}, {1, 3, 5}, {0, 3, 6} 


5 


{1, 2, 5}, {0, 5, 6}, {1, 4, 6}, {0, 3, 4}, {2, 3, 6} 


6 


{3, 4, 5}, {0, 1, 4}, {0, 2, 5}, {2, 4, 6}, {1, 3, 6} 



Figure 1: A deterministic (3, 3, l)-strategy having a set of six possible announcements 

scheme, for any given hand, there is only one possible announcement that is permitted by the given 
strategy. 

More generally, suppose there exists a constant 7 such that \g(HA)\ = 7 for every Ha- Further, 
suppose that every probability distribution pu A is uniform, i.e., Ph a {^) = 1/7 for every Ha and for 
every % G g{HA)- We refer to such a strategy as a ^-equitable strategy. A deterministic scheme is 
just a 1-equitable strategy. 

Example 1.1. Let X = {0, ...,6}. Figured presents a partition of that is due to Charlie 
Colbourn and Alex Rosa (private communication). This yields a deterministic (3, 3,1) -strategy 
having m = 6 possible announcements. 

Example 1.2. Let X = {0, . . . ,6}. Ln Figured we present a set of ten announcements found by 
Don Kreher (private communication). It can be verified that every 3-subset of X occurs in exactly 
two of these announcements. Therefore we have a 2-equitable (3, 3,1) -strategy. 

1.3 Organization of the Paper 

In Section [2j we study and define the notions of informative, weakly 1-secure, and perfectly 1- 
secure strategies. In Section [3l we explore strategies that are simultaneously informative and either 
weakly or perfectly 1-secure, and include an analysis of perfectly 1-secure strategies with c = a — 2 
in Section [370 We present a generalization of the notions of weak and perfect 1-security and analyze 
the case of perfectly (d — l)-secure strategies satisfying c = a — d in Section HI We conclude in 
Section [6l 

2 Informative and Secure Strategies 
2.1 Strategies that are Informative for Bob 

Let's first consider an (a,6, c)-deal from Bob's point of view, after hearing Alice's announcement. 
Suppose that Hb € (^) and i € {1, . . . , m}. Define 

V{H B , i) = {H A € Ai :H A nH B = 0}. 
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1 


{2, 5, 6}, {2, 3, 4}, {1, 4, 5}, {1, 3, 6}, {0, 4, 6}, {0, 3, 5}, {0, 1, 2} 


2 


{2, 5, 6}, {2, 3, 4}, {1, 4, 6}, {1, 3, 5}, {0, 4, 5}, {0, 3, 6}, {0, 1, 2} 


3 


{3, 4, 5}, {2, 4, 6}, {1, 3, 6}, {1, 2, 5}, {0, 5, 6}, {0, 2, 3}, {0, 1, 4} 


4 


{3, 4, 5}, {2, 4, 6}, {1, 5, 6}, {1, 2, 3}, {0, 3, 6}, {0, 2, 5}, {0, 1, 4} 


5 


{3, 4, 6}, {2, 3, 5}, {1, 4, 5}, {1, 2, 6}, {0, 5, 6}, {0, 2, 4}, {0, 1, 3} 


6 


{3, 4, 6}, {2, 3, 5}, {1, 5, 6}, {1, 2, 4}, {0, 4, 5}, {0, 2, 6}, {0, 1, 3} 


7 


{3, 5, 6}, {2, 4, 5}, {1, 3, 4}, {1, 2, 6}, {0, 4, 6}, {0, 2, 3}, {0, 1, 5} 


8 


{3, 5, 6}, {2, 4, 5}, {1, 4, 6}, {1, 2, 3}, {0, 3, 4}, {0, 2, 6}, {0, 1, 5} 


9 


{4, 5, 6}, {2, 3, 6}, {1, 3, 4}, {1, 2, 5}, {0, 3, 5}, {0, 2, 4}, {0, 1, 6} 


10 


{4, 5, 6}, {2, 3, 6}, {1, 3, 5}, {1, 2, 4}, {0, 3, 4}, {0, 2, 5}, {0, 1, 6} 



Figure 2: An equitable (3,3, l)-strategy having a set of ten possible announcements 



V(H B ,i) denotes the set of possible hands that Alice might hold, given that Bob's hand is Hb and 
Alice's announcement is A%. Alice's strategy is informative for Bob provided that 

\V(H B ,i)\<l (1) 

for all Hb £ ( b ) and for all i. In this situation, if Bob holds the cards in Hb and Alice broadcasts 
i, then Bob can determine the set of a cards that Alice holds. 

If for a particular announcement Ai and any hand Hb € ( b ), we have \V{Hb,i)\ < 1, we say 
that Ai is an informative announcement. This terminology is in keeping with previous work, which 
considers protocol characteristics only on the level of individual announcements. 

The following result was shown by Albert et al. PQ, albeit using different terminology: 

Theorem 2.1. The announcement Ai is informative for Bob if and only if there do not exist two 
distinct sets Ha, H' a 6 Ai such that \Ha CI H' A \ > a — c. 

Proof. Suppose there exist two distinct sets Ha,H' a E Ai such that \Ha H H' a \ > a — c. We 
have that \Ha U H' a \ < 2a — (a — c) = a + c = n — b. Hence, there exists Hb € ( 6 ) such that 
H B n (H A U H' A ) = 0. Then {H A , H' A } C V(H B ,i), which contradicts (pQ). 

Conversely, suppose {Ha, H' a } C P(H B ,i), where Ha ^ H' A . Then \Ha U -£/^| < n — 6 = a + c, 
and hence |_ff,4 PI H' A \ > a — c. □ 

It follows from Theorem 12.11 that the (3, 3, l)-strategies presented in Examples 11.11 and 11.21 are 
both informative for Bob, because \Ha H H'A < 1 whenever H a and H' A are two distinct sets in 
the same announcement. 

We also have the following necessary condition. 

Corollary 2.2. Suppose there exists a strategy for Alice that is informative for Bob. Then a > c. 
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Furthermore, when a > c, we can derive a lower bound on the size of Alice's announcement. 

Theorem 2.3. Suppose a > c and there exists a strategy for Alice that is informative for Bob. 
Then m > { n ~ a c +c ) . 

Proof. Let X' C X where \X'\ = a — c. There are precisely ( n_ " +c ) a-subsets of X that contain 
X' . These a-subsets must occur in different announcements, by Theorem 12.11 Therefore m > 

^n—a+c^ |— | 

In view of the above theorem, an (a, b, c)-strategy for Alice that is informative for Bob is said to 
be optimal if m = ( n_ " +c ) • We will next give a nice combinatorial characterization of such optimal 
strategies. First, we require some definitions from design theory. 

Definition 2.1. Suppose that t,v,k and A are positive integers with t < k < v. A t-(v,k,X)- 
design is a pair (X,B), where X is a set of v points and B is a multiset of k-element subsets of 
X called blocks, such that every subset of t points from X occurs in precisely X blocks in B. A 
t-(v,k, A) -design, (X,B) is simple if every block in B occurs with multiplicity one. 

In a 2-(v, k, A)-design, every point occurs in exactly X(v — l)/(/c — 1) blocks and the total number 
of blocks is Xv(v - l)/{k(k - 1)). 

A Steiner triple system of order v (denoted STS(u)) is a 2-(v, 3, l)-design. It is well-known that 
an STS(u) exists if and only if v = 1,3 mod 6, v > 7 (Theorem 4.18 of [6], p. 70). 

Definition 2.2. A large set of t-(v,k,l) -designs is a set of t-(v, k, 1) -designs, (X, B\), . . . , (X, Bn) 
(all of which have the same point set, X), in which every k-subset of X occurs as a block in precisely 
one of the Bis. (Thus, the Bi,s form a partition of ( , ) .) It is easy to prove that there must be exactly 
N = designs in the large set. 

There are v — 2 designs in a large set of STS(i>); it is known that a large set of STS(u) exists if 
and only if v = 1, 3 mod 6, v > 9 (Theorem 4.24 of [6], p. 70). 

Theorem 2.4. Suppose that a > c. An optimal (a, 6, c) -strategy for Alice that is informative for 
Bob is equivalent to a large set of t-(n, a, l)-designs, where t = a — c. 

Proof. Suppose there exists a large set of (a — c)-(n, a, l)-designs. Then it is easy to see that this 
immediately yields an optimal (a, b, c)-strategy for Alice that is informative for Bob. 

Conversely, suppose there is an optimal (a, 6, c)-strategy for Alice that is informative for Bob. 
We need to show that every announcement is an (a — c)-(n, a, l)-design. Denote t = a — c and 
let X' C X, \X'\ = t. From the proof of Theorem I2.3| the a-subsets containing X' occur in 
( n_ c +C ) different announcements. However, there are a total of ( n_ " +c ) announcements, so every 
announcement must contain a block that contains X' . □ 

An optimal (3, 3, l)-strategy would have m = 5. From Theorem 12. 4^ the existence of such a 
strategy would be equivalent to a large set of five STS(7). As mentioned above, it is known that 
this large set does not exist. However, from Example II. 1\ we obtain a (3, 3, l)-strategy for Alice 
with to = 6 that is informative for Bob. Thus we have proven the following. 

Theorem 2.5. The minimum m such that there exists a (3, 3,1) -strategy for Alice that is infor- 
mative for Bob is m = 6. 
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2.2 Strategies that are Secure against Cathy 

Now we consider security requirements for an (a, b, c)-strategy. Suppose that Alice makes an an- 
nouncement Ai while trying to conceal information about her hand from Cathy. Necessarily Alice's 
hand is an a-subset in Ai- In fact, Cathy knows that Alice's hand must be one of the a-subsets 
in the set V(Hc,i) = {H A £ Ai : H A H Hq = 0}- Therefore Cathy does obtain some partial 
information about Alice's hand. However, it might be possible to prevent Cathy from determining 
whether any individual card in X\Hc is held by Alice or by Bob. We define two versions of this 
security property: 

Definition 2.3. 



1. Alice's strategy is weakly 1-secure against Cathy provided that, for any announcement i, for 
any He £ (^) such that V(Hc,i) ^ 0, and for any x £ X\Hq, it holds that 

< Pr[x £ H A \i,H c ] < 1. 

Weak security means that, from Cathy 's point of view, any individual card in X\Hq could be 
held by either Alice or Bob. 

2. Alice's strategy is perfectly 1-secure against Cathy provided that for any announcement i, for 
any He £ (^) such that V(Hc,i) ^ 0, and for any x £ X\Hq, it holds that 

Pr[x £ H A \i,H c ] = 



a + b 



Perfect security means that, from Cathy's point of view, the probability that any individual 
card in X\Hc is held by Alice is a constant. This probability must equal a/ (a + b) because 
Alice holds a of the a + b cards not held by Cathy. 

It is obvious that perfect 1-security implies weak l-security. 

Remark: The condition V(Hc,i) ^ is included to account for the possibility that an announce- 
ment i is not compatible with certain hands He held by Cathy. 

The conditions for weak and perfect 1-security depend on the probability distributions pn A and 
the possible announcements. We will derive simpler, but equivalent, conditions of a combinatorial 
nature when Alice's strategy is equitable. First we state and prove a useful lemma which establishes 
that in an equitable strategy, from Cathy's point of view, any hand Ha £ V(Hc, i) is equally likely. 

Lemma 2.6. Suppose that Alice's strategy is ^-equitable, Alice's announcement is i, He £ (^) 
and H A £ V(H c ,i). Then 

Proof. We have 

p rn itt , Pr[H A ,H c ,i] 
Pr[H A \Hc,i\ 
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We can compute 



Pr[H A ,H c ,i] = Pr[H c \H A ,i]Pr\i\H A ]Pr[H A ] 
1 1 1 



x — x 



Similarly, we have 

Pr[H c ,i] = ]T Pr[H c \H' A ,i}Pr[i\H' A ]Pr[H' A ] 

H> A £V{H c ,i) 

= \V(H c ,i)\x-^x-x-^. 

The result follows. □ 
Theorem 2.7. Suppose that Alice's strategy is ^-equitable. Then the following hold: 

1. Alice's strategy is weakly 1-secure against Cathy if and only if, for any announcement i, for 
any He G (^) such that V{Hq, i) 7^ 0, and for any x G X\Hq, it holds that 

1 < \{H A G V(H c ,i) : x E H A }\ < \V(H c ,i))\ - 1. 

2. Alice's strategy is perfectly 1-secure against Cathy if and only if for any announcement i and 
for any He G (^) such that V(Hc,i) ^ 0, it holds that 

\{H A eV(Ha,i):xeH A }= a ^ Hc ^ 



a + b 
for any x G X\Hc- 
Proof. Since (J2J) holds, it immediately follows that 



pr c „,„, {H A GV(H c ,i):xeH A } 

Pr[x G H A \i, H c ] = . (3) 

\P{Hc,t)\ 

Using Equation (jSJ), we observe that 
holds if and only if 

1 < \{H A G V(H c ,i) : x G H A }\ < \V(H c ,i)\ - 1. 

This gives the first condition of the theorem. 

Define r x = \{H A G V{Hc,i) ■ x G H A }\. Alice's strategy is perfectly 1-secure against Cathy if 
and only if the value Pr[x G H A \i,Hc] is independent of x. From ([3]), this occurs if and only if r x 
is independent of x. We have that 

^ r x = a\V(H c ,i)\. 

x<=X\H c 

There are a + b terms r x in the above sum. These terms are all equal if and only if they all have 
the value r = a \V(Hc,i)\/(a + b). This proves the second condition of the theorem. □ 



8 



Remark: The above characterization of weak 1-security for equitable strategies is equivalent to 
axioms CA2 and CA3 in [lj. The characterization of perfect 1-security for equitable strategies is 
equivalent to axiom CA4 in [3]. 

It can be verified that the (3,3, l)-strategy in Example 11.21 is perfectly 1-secure against Cathy. 
However, the (3, 3, l)-strategy in Example 11.11 is only weakly 1-secure against Cathy. 
Here is a sufficient condition for a strategy to be perfectly 1-secure against Cathy. 

Lemma 2.8. Suppose that each announcement in an equitable (a, 6,1)- strategy is a 2-(n,a, X)- 
design. Then the strategy is perfectly 1-secure against Cathy. 

Proof. Given an announcement Ai and a point x, there are 



blocks in Ai that do not contain x. Each of the points in is contained in precisely 



of these blocks. □ 

3 Simultaneously Informative and Secure Strategies 

In general, we want to find an (a, 6, c)-strategy (for Alice) that is simultaneously informative for 
Bob and (perfectly or weakly) 1-secure against Cathy. 

The following was first shown by Albert et al. |T] using a different proof technique: 

Theorem 3.1. If a < c + 1, then there does not exist a strategy for Alice that is simultaneously 
informative for Bob and weakly 1-secure against Cathy. 

Proof. In view of Corollary 12.21 we only need to consider the case a = c + 1. In this case, any 
two a-subsets in an announcement must be disjoint, by Theorem 12.11 For any announcement Ai 
and any x £ X, the definition of weak 1-security necessitates the existence of a block in Ai that 
contains x. It therefore follows that every Ai forms a partition of X into n/a blocks. 

Now, suppose that Alice's announcement is Ai and Cathy's hand is Hq- There exists at least 
one Ha € Ai such that Ha H He ^ 0. Now, \Hq\ < \Ha\i so there is a point x £ Ha\Hc- The 
existence of this point violates the requirement of weak 1-security. □ 

Theorem 3.2. Suppose (a, b, c) = (3, n — 4, 1), where ri = 1,3 mod 6, n > 7. Then there exists an 
optimal strategy for Alice that is informative for Bob and perfectly 1-secure against Cathy. 

Proof. If n = 1,3 mod 6, n > 7, then there exists a large set of disjoint STS(n) on an n-set X. 
Theorem l2.4l establishes that the resulting strategy is informative for Bob, because no announcement 
Ai (the set of blocks of an STS(n)) contains two blocks that intersect in more than one point. Perfect 
1-security follows immediately from Lemma 12.81 □ 
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In the case n = 7, there does not exist a large set of STS(7), so we cannot construct an optimal 
(3, 3, l)-strategy. However, Example 11,21 provides us with an equitable strategy with m = 10 and 
7 = 2 that is informative for Bob and perfectly 1-secure against Cathy. This is because every 
announcement in this strategy is an STS(7) and every 3-subset occurs in exactly two announce- 
ments. Examples from the literature for this case typically only provide weak 1-security. Atkinson 
et al. [3] give a solution for the perfect 1-security case that requires a much larger communication 
complexity m and also involves a complicated procedure in order to avoid card bias. 

Next, we give a general method of obtaining equitable strategies from a single "starting design" . 
First we require some definitions. 

Definition 3.1. Suppose that T> = (X,B) is a t-{v,k,X)- design. An automorphism of T> is a 
permutation tt of X such that tt fixes the multiset B. The collection of all automorphisms ofT> is 
denoted Aut(D); it is easy to see that Aut(T>) is a subgroup of the symmetric group Sx- 

Theorem 3.3. Suppose that T> = (X,B) is a t-(n,a, l)-design with t = a — 1. Then there exists a 
■y-equitable (a, n — a — 1, l)-strategy with m announcements that is informative for Bob and perfectly 
1-secure against Cathy, where 7 = n!/|Aut(D)| and m = j(n — t). 

Proof. Let the symmetric group S n act on T>. We obtain a set of designs isomorphic to T>. Every 
one of these designs is a 2-design because o > 3, so the resulting scheme is perfectly 1-secure against 
Cathy by Lemma 12.81 Every design is also an (a — l)-design with A = 1, so Theorem 12.11 implies 
the scheme is informative for Bob. 

Finally, every block is in n!/|Aut(X>)| of the resulting set of designs and the total number of 
designs is equal to 7(71 — a + 1). □ 

Example 3.1. It is known that there is a 3-(8, 4, l)-design having an automorphism group of order 
1344. (See, for example, result 13 of Section I.4 of Dembowski JBj.) Theorem \3.3\ thus yields 
a 30-equitable (4,3,l)-strategy with 150 announcements that is informative for Bob and perfectly 
1-secure against Cathy. However, in this particular case, we can do better. Don Kreher (private 
communication) has found a set of ten 3-(8,4, l)-designs on a set of points X = {0, . . . , 7} such 
that every A-subset of X occurs in exactly two of these designs. Therefore we have a 2-equitable 
(4, 3,1) -strategy with ten announcements that is informative for Bob and perfectly 1-secure against 
Cathy. The set of 3-(8, 4, 1) -designs can be constructed as follows: Begin with a 3-(8, 4, 1) -design 
having the following set Aq of 14 blocks: 

{3, 4, 5, 6}, {2, 5, 6, 7}, {2, 3, 4, 7}, {1,4, 5, 7}, {1,3, 6, 7}, {1,2,4, 6}, {1,2, 3, 5}, 
{0, 4, 6, 7}, {0, 3, 5, 7}, {0, 2, 4, 5}, {0, 2, 3, 6}, {0, 1, 5, 6}, {0, 1, 3, 4}, {0, 1, 2, 7}. 

Define the permutation tt = (0, 1) (2) (3, 4, 6, 7, 5) and let tt (and its powers) act on Ac>. 
3.1 Strategies with c = a — 2 

In this section, we focus on (a, b, a — 2)-deals that are simultaneously informative for Bob, equitable, 
and perfectly 1-secure against Cathy. Where possible, we weaken our assumption that the strategy 
is equitable and our assumption of perfect 1-security to achieve the given result. We do assume that 
the strategies discussed are informative throughout these results, although we may not re-emphasize 
this point in the intervening discussion. We begin with some notation. 
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Consider an (a, b, c)-deal and a corresponding announcement Ai. For any point x € X, we 
define the 6/ocA; neighborhood of x with respect to Ai, denoted B x , to be B l x = {Ha G «4j : x G -#4} 
and the neighborhood of x with respect to Ai, denoted Ni(x), to be 



For ease of notation, if the choice of Ai is understood from context, we sometimes write G for Gi, 



If i is understood from context, we refer to B xlt ___ )Xt and N(x±, . . . , a^). 

We begin with a preliminary lemma concerning block neighborhoods. A simple consequence 
of an (a, b,a — 2)-strategy being informative is that the intersection of any two distinct block 
neighborhoods has cardinality less than one. 

Lemma 3.4. Consider an (a, b, c)-deal such that a — c = 2 and a corresponding announcement Ai. 
Suppose that Alice's strategy is informative for Bob. Then for any distinct x,y G X, there is at 
most one hand Ha G Ai such that x,y G Ha- That is, \B X n B y \ < 1. 

Proof. This follows directly from Theorem 12.11 □ 

An interesting question concerns which hands are possible (i.e., occur with probability greater 
than zero) for Cathy for any given announcement Ai- The following lemma shows that Cathy may 
hold a subset of any hand Ha that appears in Ai- We will then extend this result to show that 
Cathy's hand may consist of a subset of size c — 1 from any hand Ha appearing in Ai, together 
with another card z ^ Ha- 

Lemma 3.5. Consider an (a,b,c)-deal such that a — c = 2 and a corresponding announcement 
Ai. Suppose that Alice's strategy is informative for Bob and weakly 1-secure against Cathy. Let 
Ha G Ai and Y C Ha satisfying \Y\ = c. Then V(Y,i) ^ 0. 

Proof. We proceed by contradiction. Write Ha = {x\, . . . ,x a } and Y = {x±, . . . , x c }. Suppose 
V(Y,i) = 0. Then every hand of Ai intersects Y. In particular, by Lemma |3.4| every hand in Ai 
(excluding Ha) contains exactly one element of Y. 

Now, since Alice's strategy is weakly 1-secure against Cathy, there must be some H' A 6 A% such 
that H' A ^ Ha- By the above argument, \H' A C\Y\ = 1. Suppose, without loss of generality, H' A 
contains x\. We will now use the existence of H' A to construct a possible hand for Cathy that would 
imply Alice holds x\. 

Define Y' = {x2, ■ ■ ■ , x a _i}, so \Y'\ = c. Then V(Y' , i) consists of all the blocks in Ai containing 
xi (except for Ha). In particular, H' A 6 V(Y' ,i), so this set is nonempty, and therefore Y' is a 
possible hand for Cathy. But if Cathy holds Y' , Alice must hold x\, which contradicts the security 
assumption. □ 




N(x) for Ni(x), and B x for B x . 



We can also extend these notions as follows. Define B X1 x = 
That is, we say B l x Xt is the block neighborhood of the set {x\ 
neighborhood of x\, ... ,x t , denoted N(x\, . . . ,x t ) % , to be 



{H A G Ai : xx, ...,x t G H A }. 
...,xt}. Similarly, define the 
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Before we generalize Lemma 13.51 we will need the following result, which shows that, given a 
particular announcement Ai and choice of card x, at least two hands in A% must contain x and at 
least two hands in Ai must not contain x. We remark that Albert et al. [Ij show a related result, 
namely that given an informative and weakly 1-secure announcement, each card must appear in at 
least c + 1 hands. 

Lemma 3.6. Consider an (a, b, c)-deal such that a — c = 2 and a corresponding announcement Ai. 
Suppose that Alice's strategy is informative for Bob and weakly 1-secure against Cathy. Suppose 
Then there are at least two hands of Ai containing x and at least two hands of Ai that do 
not contain x. 

Proof. We proceed by contradiction. We first show there exist Ha, H' a £ Ai which contain x. Now, 
there must be some Ha £ Ai satisfying x £ Ha, as otherwise x is not held by Alice. Suppose 
all other hands of Ai do not contain x. By Lemma 13.51 we may pick Y C Ha, \Y\ = c, where 
V(Y,i) ^ 0. That is, Y is a possible hand for Cathy. But since Ha ^ V(Y,i), there must be some 
other H' A £ Ai such that x £ H' A . Otherwise, if Cathy holds Y, then Cathy knows x is not held by 
Alice. 

We show in a similar fashion there exist Ha, H' a £ Ai which do not contain x. There must be 
some Ha £ Ai satisfying x ^ Ha, as otherwise x must be held by Alice. Suppose all other hands 
of Ai contain x. By Lemma 13.51 we may pick Y C Ha, \Y\ = c, where V{Y, i) ^ 0. That is, Y is 
a possible hand for Cathy. But since Ha ^ V(Y,i), there must be some other H' A £ Ai such that 
x £ H' A . Otherwise, if Cathy holds Y, then Cathy knows x is held by Alice. □ 

Lemma 3.7. Consider an (a,b,c)-deal such that a — c = 2. Suppose that Alice's strategy is 
informative for Bob and weakly 1-secure against Cathy. Let Ha £ Ai and Y C Ha satisfying 
\Y\ = c - 1. Let z £ X such that z H A . Then V(Y U {z}, i) ^ 0. 

Proof. We proceed by contradiction. Write Ha = {x\, . . . ,x a } and Y = {x\, . . . ,x c -i}. Suppose 
V{Y U {z},i) = 0. Then every hand of A% intersects Y U {z}. In particular, by Lemma 13.41 every 
hand in Ai (excluding Ha) contains at most one element of Y. 

Now, by Lemma 13.61 there must be some H' A £ Ai such that H' A ^ Ha and z ^ H' A . By the 
above argument, \H' A D (Y U {z})\ = 1. Suppose, without loss of generality, H' A contains x\. We 
will now use the existence of H' A to construct a possible hand Y' for Cathy that would imply Alice 
holds x\. 

Define Y' = {x2, ■ ■ ■ , x c , z} = Y U {z} U {x c }, so \Y'\ = c. Here we include x c £ Y' for technical 
reasons. We want |Y'| = c and we need H' A n Y' = 0, which we have since Lemma 13.41 implies the 
elements xi,x c cannot both be in H' A . 

Then V(Y', i) consists of all the blocks in Ai that do not contain X2, ■ ■ ■ ,x c , or z. This implies 
the elements of V(Y',i) must contain x\, since every hand of Ai necessarily intersects Y U {z}. 
Since H' A £ V(Y',i), we have that this set is nonempty, so Y' is a possible hand for Cathy. But if 
Cathy holds Y', Alice must hold x\, which contradicts the security assumption. □ 

We remark that it is possible to use the above results to show that any hand is actually possible 
for Cathy in this case. That is, consider an (a, b, c)-strategy such that a—c = 2, which is informative 
for Bob and weakly 1-secure against Cathy. Given an announcement Ai and a hand Hq £ (^), 
we can show V{Hc,%) ^ 0. We do not include the proof here, however, as we do not require this 
strong of a result for our purposes. 
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We are now ready to show one of our main results concerning the special case c = a — 2. Namely, 
any (a,b,a — 2)-strategy that is informative, equitable, and perfectly 1-secure also satisfies c = 1: 

Theorem 3.8. Consider an (a,b,c)-deal such that a — c = 2. Suppose that Alice's strategy is 
equitable, informative for Bob, and perfectly 1-secure against Cathy. Then a = 3 and hence c = 1. 

Proof. Consider an announcement Ai- Suppose Ha = {x\, . . . ,x a } G A%. First note that a > 3, 
since c > 1 and a — c = 2. 

Let B Xl be the block neighborhood of x\ and suppose \B Xl \ = r. Let B X2 be the block neigh- 
borhood of %2 and suppose \B X2 \ = s. By Lemma 13.61 we have r, s > 2. 

Set Hq = {xs, . . . , x a }. By Lemma [331 we have V{Hc, i) ^ 0. Then we have (by Lemma ETl"]) . 
\B Xi \Bh c \ = r — 1 and \B X2 \Bh c \ = s — 1. By Theorem 12.71 we have \B x1 \Bh c \ = \B X2 \Bh c |, so 
r = s. 

Now consider z such that z G iV(xi). We show z £ N(x 2 ) as well. For the case c = 1, Lemma [3. 51 
implies we may set -ffc* = I- 2 }- Then if z ^ N{x 2 ), by Lemma [3.4} we would have l-R^-B^ | = r — 1 
and |i? X2 \i?/f c , | = s. By Theorem 12.71 we have r — 1 = s, a contradiction since r = s. It now suffices 
to consider a > 4. Set ile = {X4, . . . ,x a ,z}; by Lemma [3771 we have V(Hc,i) ^ 0, so He is a 
possible hand for Cathy. If z ^ N(x 2 ), by Lemma 13. 4| we would have |B xl \B/f c ,| = r — 2 and 
l-B^ \Bh c \ = s — 1. But by Theorem 12. 7| we have r — 2 = s — 1, a contradiction since r = s. 
Therefore z € N(x2). 

Suppose H' A = {zx,...,z a -\,x\} G B Xl , where / Ha, and set F c = {zi, ■ ■ ■ , z a _ 2 } ■ By 
Lemma [3~il |S a;i \Bjf c [ = r — 1. By the above argument, 2i, . . . , z a _2 £ -^(^2) arid by Lemma I3T4"! 
these points occur in different blocks of x 2 and each point occurs exactly once. So \B X2 \Bh c \ = 
s — (a — 2). By Lemma [3.51 we have V(Hc,i) 7^ 0. So by Theorem 12.71 we have \B Xi \Bh c \ = 
\B X2 \Bh c \, so r — 1 = s — a + 2. Since we also have r = s, this implies a = 3, as desired. □ 

In light of Theorem 13.81 we now focus on (3, n — 4, l)-strategies that are equitable and perfectly 
1-secure. Given this special case, the stronger security assumption allows us to state some useful 
results concerning the neighborhoods of particular cards. We first show that any two points must 
have a common neighbor, which provides the basis for a much stronger result concerning neighbor- 
hoods. In fact, the neighborhoods of any two distinct points (minus the points themselves) are the 
same. The next two lemmas are the final ingredients needed for our second main result, namely 
that announcements in such strategies are necessarily Steiner triple systems. 

Lemma 3.9. Suppose (a,b,c) = (3, n — 4,1) and fix a corresponding announcement Ai- Suppose 
that Alice's strategy is equitable, informative for Bob, and perfectly 1-secure against Cathy. Then 
for any distinct x,y G X, there exists z £ X such that z G N(x) D N(y). 

Proof. We proceed by contradiction. Let x,y G X and suppose N(x) fl N(y) = 0. We proceed by 
using a combination of Lemma [3. 41 and the results of Theorem l2.7l to count and compare the size of 
the block neighborhoods of x and y in light of possible hands for Cathy. Recall that, from Cathy's 
point of view, the block neighborhoods of x and y must have the same size. 

Let B x be the block neighborhood of x and suppose \B X \ = r. Let B y be the block neighborhood 
of y and suppose \B y \ = s. From Lemma 13.61 we have r, s > 2. 

Thus, there must be some I G N(x) such that t ^ N(y). By Lemma 13.51 we may set Hq = {(.}■ 
Consider B x \Bh c - By Lemma I3T41 and since £ G N(x), we see that \B x \Bh c \ = \B X \ — 1 = r — 1. 
Since t ^ N(y), we have \B v \Bh c \ = s. Then since Alice's strategy is perfectly 1-secure against 
Cathy, by Theorem 12.71 we also have \B x \Bh c \ = \B v \Bh c \- This implies s = r — 1. 
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Similarly, we have some £' £ N(y) such that £' ^ N(x). By Lemma 13.51 we may set He = {£'}■ 
By the same argument as above, we have \B v \Bh c \ = \B y \ — 1 = s — 1 and \B x \Bh c \ = r. Since 
\B x \Bh c \ = l-^s/Y^ffcl) we conclude s = r + 1. 

Thus we have a contradiction. □ 

Lemma 3.10. Suppose (a,b,c) = (3, n — 4,1) and and fix a corresponding announcement Ai. 
Suppose that Alice's strategy is equitable, informative for Bob, and perfectly 1-secure against Cathy. 
Then for any distinct x,y £ X, we have N(x)\{y} = N(y)\{x}. 

Proof. Let x,y £ X be distinct. Let B x be the block neighborhood of x and suppose \B X \ = r. Let 
By be the block neighborhood of y and suppose \B y \ = s. Prom Lemma 13.61 we have r, s > 2. We 
use a technique similar to that used in the proof of Lemma 13.91 i- e -> counting and comparing the 
sizes of block neighborhoods. 

By Lemma [3.91 there exists z£l such that z £ N(x) PiN(y). We observe that, by Lemma [3. 5 1 
we may set He = {z}. Then we have (by Lemma 13. 4ft \B x \Bjj c \ = r — 1 and \By\Bjj c \ = s — 1. 
By Theorem 12.71 we have \B x \Bh c \ = \B v \Bh c |, so r = s. 

We proceed by contradiction. First suppose there is t ^ x,y such that £ £ N(x) but £ ^ X(y). 
By Lemma 13.51 we may set He = {£}■ We then have (by Lemma I3.4p \B x \Bh c \ = r — 1 and 
\By\BH c | = s. By Theorem 12.71 we have \B x \Bh c \ = \B y \BH c |, so s = r — 1, a contradiction. 
This implies that N(x)\{y} C iV(y)\{x}. 

Now suppose there there is £' ^ x,y such that £' £ -/V(y) but ^ N(x). We observe that, by 
Lemma 1331 we may set He = {£'}■ We then have (by Lemma l3T4|) \B x \Bh c \ = r and |B J/ \i?^ c ,| = 
s — 1. By Theorem 12.71 we have |i? a: \i?// c ,| = \B v \Bh c |, so r = s — 1, a contradiction. This implies 
that iV(y)\{x} C iV(x)\{y}. □ 

Theorem 3.11. Suppose (a,b,c) = (3, n — 4,1) and suppose that Alice's strategy is equitable, 
informative for Bob, and perfectly 1-secure against Cathy. Then every announcement is a Steiner 
triple system. 

Proof. Fix an (a, b, c)-deal and suppose Alice's strategy is equitable, informative for Bob, and 
perfectly 1-secure against Cathy. Consider a corresponding announcement A{. Then in particular, 
each hand of Ai has size 3. 

We first observe that Lemma 13.41 implies that any pair x,y £ X occurs in at most one hand of 
Ai- It remains to show that any pair x, y £ X occurs in exactly one hand of Ai. 

Let x, y £ X. By Lemma 13.91 there is some point z £ X such that z £ N(x) D N(y). In 
particular, x £ N(z). By Lemma 13.101 we have N(z)\{y} = N(y)\{z}. Since z £ N(y), we see 
that N(z)\{y} U {z} = N(y). But x ^ y, z and x £ N(z), so we have x £ N(y). This gives us the 
desired result. □ 

We present an interesting example in the case a = 4, c = 2. 

Example 3.2. It was proven by Chouinard that there is a large set o/2-(13, 4, l)-designs. There 
are ( 2 ) =55 designs in the large set. This yields a deterministic (4, 7, 2) -strategy that is informative 
for Bob. We can easily determine the security of the scheme against Cathy. Suppose that Alice's 
announcement is Ai and Cathy's hand is He = {y, z}. There is a unique block in Ai that contains 
the pair {y,z}, say {w,x,y,z}. There are three blocks that contain y but not z, and three blocks 
that contain z but not y. Since Ai contains 13 blocks, it follows that the set V({y,z},i) consists 
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of six blocks. Within these six blocks, w and x occur three times, and every point in X\{w, x, y, z} 
occurs twice. Therefore, we have 

Pr[w G H A \H C ] = Pr[x G H A \H C ) = \ 

and 

Pr[u G H A \H C ] = ^ 

for all u G X\{w,x,y,z}. If a (4, 7, 2) -strategy were perfectly 1-secure against Cathy (which is 
impossible, in view of Theorem \3.8\) . we would have Pr[u G H A \Hc] =4/11 for all u G X\Hq- 

4 Generalized Notions of Security 

We may generalize the definitions of weak and perfect 1-security to weak and perfect 5-security in 
the natural way. 

Definition 4.1. Let 1 < 5 < a. 

1. Alice's strategy is weakly 5-secure against Cathy provided that for any 5' such that 1 < 5' < S, 
for any announcement i, for any He G ( ) such that V(Hc, i) 7^ 0, and for any x±, . . . , xgi G 
X\Hc, it holds that 

< Pr[ Xl ,...,x s , G H A \i,H c ] < 1. 

Weak security means that, from Cathy's point of view, any set of S or fewer elements from 
X\Hq may or may not be held by Alice. 

2. Alice's strategy is perfectly 5-secure against Cathy provided that for any 5' such that 1 < 
5' < 5, for any announcement i, for any He G (^) such that V(Hc,i) 7^ 0, and for any 
Xi,...,xgi G X\Hq, it holds that 

( a ) 

Pr[x 1 ,...,x s .€H A \i,H c ] = -$L-. 

{ 5' ) 

Perfect security means that, from Cathy's point of view, the probability that any set of 5 or 
fewer cards from X\Hq is held by Alice is a constant. 

It is obvious that perfect 5-security implies weak 5-security. 

Remark: The condition V(Hc,i) 7^ is included to account for the possibility that an announce- 
ment i is not compatible with certain hands He held by Cathy. 

The conditions for weak and perfect (5-security depend on the probability distributions pn A 
and the possible announcements. As before, we will derive simpler, but equivalent, conditions of a 
combinatorial nature when Alice's strategy is equitable. 

Theorem 4.1. Suppose that Alice's strategy is ^-equitable. Then the following hold: 

1. Alice's strategy is weakly 5-secure against Cathy if and only if, for any 5' such that 1 < 8' < 5, 
for any announcement i, for any Hq G (^) such that V(Hc, i) 7^ 0, and for any xi,...,xgi G 
X\Hc, it holds that 

1 < \{H A £V(H c ,i) :xi,...,x s > & H A }\ < \V(H C , i))\ - 1. 
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2. Alice's strategy is perfectly 5-secure against Cathy if and only if, for any announcement i and 
for any He G (^) such that V{Hc,i) 7^ 0, it holds that 



\{H A eV(H c ,i) :x 1 ,...,x s eH A }\ 



(|) W(H c ,i)\ 

rn 



for any x\ 



...,x 6 € X\H C . 



Proof Let 1 < 6' < S. 

Since ([2]) (from Lemma l2,6p holds, it immediately follows that 




(4) 



Using Equation @, we observe that 



< 



{H A £V(H c ,i) : x\, . . . , x$i G H A }\ 
W(Hc,i)\ 



< 1 



holds if and only if 



1 < \{H A G V(H c ,i) :x 1 ,...,x S ' £ H A }\< \V{H c ,i)\ - 1. 



This gives the first condition of the theorem. 

For the second condition of the theorem, we first remark that, if the given security property 
holds for <5, it will automatically hold for 5' such that 1 < 8' < 5. This is because the security 
property for 5 says that every 5-subset occurs the same number of times within a certain set of 
blocks of size \V(Hc,i)\- That is, we have a t-design with t = 5. It is a standard result that every 
t-design is a t'-design for all t' < t. Thus it suffices to show that, for any announcement i and for 
any He € ( c ) such that V(Hc, i) ^ 0, and for any x±, . . . ,x$ € X\Hc, then 



Define r xl ,..., Xs = \{H A G V(Hc,i) ■ xi,...,xg G H A }\. Alice's strategy is perfectly 5-secure 
against Cathy if and only if the value Pr[xi, . . . ,x$ G H A \i,Hc] is independent of the 5-subset 
{x±, . . . , xs}- From ([4]), this occurs if and only if r xlt ___ iXs is independent of the 5-subset {x\, . . . , x$}- 
We have that 



\{H A eV(H c ,i) 




holds if and only if 



Pr[xi,. 






There are ( a ~T ) terms rp in the above sum. These terms are all equal if and only if they all have 



the value r = (^) \V(Hc,i)\/ ( a ~^ b ) ■ This completes the proof. □ 
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Lemma 4.2. Suppose that each announcement in an equitable (a, 6,1) -strategy is a t-(n,a,X)- 
design. Then the strategy is perfectly (t — l)-secure against Cathy. 



Proof. Given an announcement Ai and a point x, there are 




) 



blocks in Ai that do not contain x. For any subset S = {x\, . . . , x s -i} C X\{x} of size s — 1, where 
1 < s < i, the subset 5 is contained in precisely 



Lemma 14.21 immediately implies the following: 

Corollary 4.3. The construction method given in Theorem which shows how to obtain an 
equitable strategy from a single starting t — (n, a, l)-design, where t = a — 1, yields a strategy that 
is perfectly (a — 2) -secure. 

4.1 Strategies with c = a — d 

In this section, we generalize the results of Section \3. 11 That is, we consider the case of (a, b, a — d)- 
deals that are simultaneously informative for Bob and perfectly (d— l)-secure against Cathy. Where 
possible, we weaken our assumption that the strategy is equitable and satisfies perfect (d — 1)- 
security to achieve the given result. We do assume that the strategies discussed are informative 
throughout. 

Although the results of Section 13.11 are subsumed by the parallel results of this section, we feel 
it is useful to include both. Section 13.11 provides a good basis for understanding the results of this 
section; the proofs of the generalized results are much more technical and complicated than those 
for the simple case where c = a — 2. For readability, we include a list of correspondences between 
the results of these two sections in Table [TJ 




of these blocks. 



□ 



Remark 4.1. Lemma \4-.S\ is a generalization of Lemma 1 2. 81 



Result in Section 13.11 



Table 1: Correspondences between Results 
Corresponding Result in Section 14.11 



Lemma 13.41 
Lemma 13.51 
Lemma 13.61 
Lemma 13.71 
Theorem ESI 



Lemma 14.41 
Lemma 14.51 
Lemma 14.61 
Lemma 14.71 
Theorem l4~8l 
Lemma 14.91 



Lemmas EH [3TTU1 



Theorem 13.111 



Theorem 14.10 
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The main result of this section is that any (a, b,a — d)-strategy that is informative, equitable, 
and perfectly (d— l)-secure also satisfies c = 1; that is, d = a — 1. Moreover, announcements in such 
strategies are necessarily d-(n, d + 1, 1) designs. To achieve these results, however, we do need an 
additional assumption; namely that b is sufficiently large. As we will see, taking b > d — 1 suffices. 
We do not know if this assumption is necessary, however. 

Lemma 4.4. Consider an (a, b, c)-deal such that a — c = d, and a corresponding announcement Ai. 
Suppose that Alice's strategy is informative for Bob. Then for any distinct xi, . . . , x& G X , there is 
at most one hand Ha G Ai such that x±, . . . ,Xd G Ha- That is, |-Bxi,...,x d | 5- 1- 

Proof. This follows directly from Theorem 12.11 □ 

Lemma 4.5. Consider an (a,b,c)-deal such that a — c = d and b > d — 1. Fix a corresponding 
announcement Ai. Suppose that Alice's strategy is informative for Bob and weakly (d — 1) -secure 
against Cathy. Let Ha G Ai and Y C Ha satisfy \Y\ = c. Then V(Y,i) ^ 0. 

Proof. We proceed by contradiction. Write Ha = {xi, . . . ,x a } and Y = {x±, . . . , x c }. Suppose 
V(Y, i) = 0. Then every hand of Ai intersects Y. 

Now, since Alice's strategy is weakly (d— l)-secure against Cathy, there must be some H' A G Ai 
such that H' A ^ Ha- By the above argument, \H' A (1Y\ > 1. 

Suppose \H' A f]Y\=£' and \H A n H' A \ = £. Note that £' < £ < d - 1 holds by Lemma KM and 
£' < c holds by construction. Without loss of generality, assume H' A contains x\,... ,X£>. 

We now wish to construct a special possible hand for Cathy, say Y', that will allow us to derive 
a contradiction. That is, we will construct a Y' such that Ha £ V(Y',i), but V(Y',i) contains a 
hand H" A satisfying \Ha D H a \ > d. To ensure Y' is a possible hand for Cathy, we construct Y' 
using elements that do not appear in H' A , so that H' A S V(Y',i) and hence V(Y',i) is nonempty. 
For technical reasons, we pick one element z that occurs in Ha but not H' A , and £' — 1 elements 
2i, . . . , zgi-x that occur outside of both Ha and H^, and use these in our construction of Y' . 

Since Ha ^ H' A , there is some 2 G if,4 such that z ^ il^ and z is distinct from x^/ + i, . . . ,x c . 
To see this, write £ = £' + t for some i. There are d — t elements in Ha\(Y U H' a ). Thus d — t > 1 
suffices, but necessarily we have t < £ < d — 1. From a technical standpoint, we need such a point 
z for the case c = 1; this will ensure that Ha CI 1" 7^ 0. 

In addition, we may pick distinct #i, . . . , z^_\ ^ U H'a. This follows because there are at 
least a + b + (a - d) - (2a - £) = b - d + £ points not in H A U H' A . We have b- d + £>£' - lso 
long as 6 > d — 1, which is true by assumption. 

Define Y' = {x^+i, . . . , x c , Zi, . . . zp-i, z}, so \Y'\ = c. Then H' A G V(Y', i) by construction, so 
this set is nonempty, and therefore Y' is a possible hand for Cathy. Note also that Ha £ V(Y',i). 

Consider the set T = {x c+ \, . . . ,x a } C Ha, which contains d elements. Note that at most one 
of these elements is z, so we may pick a subset T'cT satisfying \T'\ = d — 1 and T' DY' = 0. Since 
the scheme satisfies weak (d — Insecurity by assumption, T' C H" A for some H" A G V(Y',i). Note 
that H'a ^ Ha- Now, H" a must intersect Y (but not Y'), so H" A must contain an element from 
{xi, . . . ,X£'}. Suppose (without loss of generality) that H" A contains x\. Then the set {x±} U T' of 
size d appears in both Ha and H A , a contradiction. □ 

Lemma 4.6. Consider an (a,b,c)-deal such that a — c = d and b > d — 1. Fix a corresponding 
announcement Ai. Suppose that Alice's strategy is informative for Bob and weakly (d — 1) -secure 
against Cathy. Suppose D = {xi, . . . ,Xd~i} C X. Then there are at least two hands of Ai contain- 
ing D and at least two hands of Ai that do not contain D. 
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Proof. We first show there exist Ha, H' a € Ai which contain D. Now, there must be some Ha £ Ai 
satisfying D C Ha, as otherwise D is not held by Alice, which contradicts the assumption that the 
scheme is weakly (d— l)-secure. Suppose all other hands of Ai do not contain D. Let Y C Ha such 
that \Y\ = c. By Lemma 14.51 we have V(Y,i) ^ 0; that is, Y is a possible hand for Cathy. But 
since Ha £ V(Y,i), there must be some other H' A G Ai such that D C Otherwise, if Cathy 
holds Y, then Cathy knows D is not held by Alice. 

We show in a similar fashion there exist Ha,H' a € Ai which do not contain D. There must be 
some Ha € Ai satisfying D <£. Ha, as otherwise D must be held by Alice. Suppose all other hands 
of Ai contain D. Let Y C Ha such that \Y\ = c. By Lemma 14.51 we have V(Y, i) ^ 0; that is, Y is 
a possible hand for Cathy. But since Ha ^ V(Y,i), there must be some other H' A 6 Ai such that 
D ^ H' A . Otherwise, if Cathy holds Y, then Cathy knows D is held by Alice. □ 

Lemma 4.7. Consider an (a,b,c)-deal such that a — c = d and b > d — 1. Fix a corresponding 
announcement Ai. Suppose that Alice's strategy is informative for Bob and weakly (d — l)-secure 
against Cathy. Let Ha € Ai and Y C Ha satisfy \Y\ = c — 1. Let z £ X such that z £ Ha- Then 

P(FuHi)/l. 

Proof. This result is only interesting for c > 2. The case c = 1 is follows directly from Lemma 14.5} 
since for any z £ X, there is some hand in Ai that contains z. 

We proceed by contradiction. Write Ha = {x\, ■ ■ ■ ,x a } and Y = {x%, . . . , x c -i}- Let z £ X 
such that z £ Ha- Suppose V(Y U {z}, i) = 0. Then every hand of Ai intersects Y U {z}. 

Now, since Alice's strategy is weakly (d— l)-secure against Cathy, there must be some H' A G Ai 
such that H' A ^ Ha and z ^ H' A (Lemma 14.61 gives a stronger result). By the above argument, 
\H' A DY\>1. 

Suppose 1-H^nYl = ^ and \H A nH' A \ = I. Note that £' < I < d-1 by LemmaEEland £' < c-1 
holds by construction. Without loss of generality, assume H' A contains x\, . . . ,xe>. 

We now wish to construct a special possible hand for Cathy, say Y', that will allow us to derive 
a contradiction. That is, we will construct a Y' such that Ha ^ V(Y',i), but V(Y',i) contains a 
hand H" A satisfying \Ha H H a \ > d. To ensure Y' is a possible hand for Cathy, we construct Y' 
using elements that do not appear in H' A , so that H' A S V(Y',i) and hence V(Y',i) is nonempty. 
For technical reasons, we pick one element z' that occurs in Ha but not H' A , and £' — 2 elements 
z\, . . . , z#-2 that occur outside of both Ha and H' A , and use these in our construction of Y' . 

Since Ha ^ H' A , there is some z' € H A such that z' ^ fl^ and z' is distinct from a^'+i, ... ,x c . 
To see this, write £ = + t for some t. There are d — t elements in Ha\(Y U H' a U {^ c })- Thus 
d — t > 1 suffices, which holds because t < £ < d — lby the security assumption. From a technical 
standpoint, we need such a point z' for the case c = 2; this will ensure that Ha H Y 7 7^ 0. 

In addition, we may pick distinct zi, . . . , z^/_2 ^ ^4 U H' A such that Zj 7^ z for 1 < i < £' — 2. 
This follows because there are at least a + b+ (a — d) — (2a — £) = b — d + £ points not in Ha U H' a . 
We have b — d + £ > £' — lso long as 6 > d — 1, which holds by assumption. (Note that we need 
£' — 1 points, not I' — 2 points, because z must be distinct from z%,... ,ze'-2, and all are points 
occurring outside of Ha U H^-) 

Define Y' = {xi> + i, . . . ,x c , z%, . . . ze'-2, z , z '}, so \Y'\ = c. Then H' A S V(Y', i) by construction, 
so this set is nonempty, and therefore Y' is a possible hand for Cathy. Note also that Ha ^ V(Y', i). 

Consider the set T = {x c+ \, . . . ,x a } C Ha, which contains d elements. Note that at most one 
of these elements is z', so we may pick a subset fcT satisfying \T'\ = d — 1 and T' CI Y 1 = 0. 
Since the scheme satisfies (d — l)-weak security by assumption, T' C H" A for some H" A G V(Y',i). 
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Note that H" A ^ Ha- But H" A must intersect Y (but not Y') so H' A must contain an element from 
{x\, . . . , X£>}. Suppose (without loss of generality) H A contains x\. Then the set {x\ \ U T' of size 
d appears in both Ha and H" A , a contradiction. □ 

Theorem 4.8. Consider an (a,b,c)-deal such that a — c = d and b > d— 1. Suppose that Alice's 
strategy is equitable, informative for Bob, and perfectly {d—l)-secure against Cathy. Then a = d+1 
and hence c = 1. 

Proof. We remark that a > d+1, since c > 1 . 

Consider an announcement A%. Suppose Ha = {x\, . . . ,x a } G Ai. Let B Xlt ___ )Xd _ 1 be the block 
neighborhood of x%, . . . , Xd-i and suppose \B xl ^^ jXd _ 1 \ = r. Let -B X2 ,...,x d be the block neighborhood 
of X2, ■ ■ ■ , Xd and suppose |-B X2 ,...,xJ = s. By Lemma 1431 we have r, s > 2. 

Set He = {xd+i, ■ ■ ■ ,x a }. By Lemma l4~5| we have V(Hc,i) ^ 0, so He is a possible hand for 
Cathy. Then we have, by Lemma |4~4"1 \B X1: ^^ x<1 _ 1 \Bh c \ = r — 1 and \B X2i ^^ x<1 \Bh c \ = s — 1. By 
Theorem 14.11 we have \B x1 ^.^ Xc1 _ 1 \Bh c \ = \B X2j _ >Xd \BH c \, so we conclude r = s. 

Now consider z such that z G N(x%, ■ ■ ■ ,Xd-x), but z £ Ha- We show z G N(x2, ■ ■ ■ ,x<i) as 
well. For the case c= 1, Lemma 14.51 implies we may set Hq = {z}. Then if z £ N(x2, ■ ■ ■ ,Xd), by 
Lemma B~4"l we would have \B Xi> ^^ x<1 _ 1 \Bh c \ = r — 1 and \B X2t ___ iXd \BH c \ = s. By Theorem 12.71 
we have r — 1 = s, a contradiction since r = s. For c > 1, we may set He = {xd+i, ■ ■ ■ , x a ~\, z}. 
By Lemma 14771 we have V(Hc,i) ^ 0, so He is a possible hand for Cathy. If z £ N(x%, . . . ,Xd), 
by Lemma [4.4^ we would have \B Xi ^^ jX(1 _ 1 \Bh c \ = r — 2 and \B X2s „. jXd \Bjj c \ = s — 1. But by 
Theorem 12.71 we have r — 2 = s — 1, a contradiction since r = s. Therefore z G N{x2, ■ ■ ■ , Xd). 

Suppose H' A = {xi, . . . ,x d -i} U {zi,.. . , z a _ d+ i} G B^,,,^^ and set H c = {z x ,. . .,z a „ d }- By 
Lemma 14.5} we have V(Hc,i) ^ 0, so He is a possible hand for Cathy. 

Now, we may pick H' A ^ Ha by Lemma [4.61 Then by Lemma |4.4[ we have \B Xlt ,,^ Xd _ 1 \BH c \ = 
r — 1. By the above argument, z\, . . . , z a _d G N(x2, ■ ■ ■ , Xd) and by Lemma 1441 these points occur 
in different blocks of B X2 ^.^ Xd and each point occurs exactly once. So |Ba; a ,... ) a; < j\-BH' c7 | = s — (a — d). 
So by Theorem I4.1} we have \B x1 ^^ jXi1 _ 1 \Bh c \ = \B X2t _ )Xd \Bu c \, so r — 1 = s — a + d. Since we 
also have r = s, this implies a = d+1, as desired. □ 

As before, we can now focus our attention on {d + 1, b, l)-strategies that are equitable, informa- 
tive for Bob, and perfectly (d — l)-secure. 

Lemma 4.9. Consider a (d+1, b, l)-deal satisfying b > d—1 and fix a corresponding announcement 
Ai. Suppose that Alice's strategy is equitable, informative for Bob, and perfectly (d — l)-secure 
against Cathy. Then for any distinct D,D' C X satisfying \D\ = \D'\ = d—1, there exists z G X 
such that z G N(D) n N(D'). Moreover, N(D)\{D'} = N(D')\{D}. 

Proof. Let D,D' C X satisfy \D\ = \D'\ = d — 1. Let Bd be the block neighborhood of D and 
suppose \Bjj\ = r. Let B^' be the block neighborhood of D' and suppose \Bjjr\ = s. From 
Lemma 14.61 we have r,s > 2. 

As in the proof of Theorem l4.8l suppose there exists t G N(D) such that I £ N(D'). We may, by 
Lemma l4~5| set He = {(■}■ Then by Lemma l4~4"l we see that \Bd\Bh c \ = r — 1 and \Bd>\Bh c \ = s. 
Then since Alice's strategy is perfectly (d — l)-secure against Cathy, by Theorem 14.11 we also have 
\Bd\Bh c \ = \Bd\Bh c \- This implies s = r — 1. 

Similarly, suppose we have some I' G N(D') such that £' £ N(D). By Lemma |4.5[ we may set 
He = {£'}■ By the same argument as above, we have \Bjji\Bh c \ = s — 1 and \Bd\Bh c \ = r. Since 
\Bd\Bh c \ = \Bd'\Bh c \i we conclude s = r + 1. 
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The above argument implies a contradiction if there exists both £ G N(D) such that £ £ N(D') 
and £' G N(D') such that £' <£ N(D). But if N(D) n N(D') = 0, such an £ and £' must exist, since 
r, s > 2. Thus, we conclude that there exists z G N(D) n N(D'). 

Moreover, by Lemma [4.51 we may set ilc = {%}■ Then by Lemma [4. 4\ we see that \Bd\Bh c \ = 
r — 1 and |5y\S^ c | = s — 1. Then since Alice's strategy is perfectly (d — l)-secure against Cathy, 
by Theorem 14.11 we a l so have | Bd\B jj c \ = \Bu'\Bh c \. This implies r = s. But this also implies 
that there cannot be £ £ N(D) such that £ <£ N(D') or £' G N(D') such that £' £ N(D). Thus we 
conclude N(D)\{D'} = N(D')\{D}, as desired. □ 

Theorem 4.10. Suppose (a,b,c) = (d + l,n — (d + 2), 1) satisfying b > d — 1 and suppose that 
Alice's strategy is equitable, informative for Bob, and perfectly (d — l)-secure against Cathy. Then 
every announcement is a d — (n, d + 1, \)-design. 

Proof. Fix an (d + 1, n — {d + 2), l)-deal and suppose Alice's strategy is equitable, informative for 
Bob, and perfectly (d— l)-secure against Cathy. Consider a corresponding announcement Ai- Then 
in particular, each hand of Ai has order d + 1. 

We first observe that Lemma 14.41 implies that any set of d elements of X occurs in at most one 
hand of Ai. It remains to show that D = {x±, . . . ,Xd} occurs in exactly one hand of Ai for any 

xi, . . . ,x d e x. 

Write D' = {x±, . . . , Xd-i} and D" = {x2, ■ ■ ■ , Xd}- By Lemma [4T9| there exists z G X satisfying 
z G N(D')nN(D"). (Note that this implies z ^ xi, . . . , x d .) That is, there exist hands Ha, H' a G Ai 
satisfying D' U {z} C H A and D" U {z} C H' A . 

Also by Lemma 14.91 we have 

N{D")\{z, x 2 , ■ ■ ■ , X d -!} = N(z, x 2 , ■ ■ ■ , x d -i)\D". 

This is equivalent to 

N{D")\{z) = N(z, z 2 , - - - , x d _!)\{x4. 

Now .D'U-fz} C i?^ implies xi G N(z, X2, • • • , a^d-i)- Given x\ ^ z, Xd, we conclude x\ G N{D"). 
That is, -D = I?" U {x\\ occurs in some hand of Ai, as desired. □ 

Example 4.1. The construction given in Example I3.il is actually an example of a 2-equitable 
(4,3, 1) -strategy that is informative for Bob and perfectly 2-secure against Cathy. The fact that the 
scheme is perfectly 2-secure follows from Lemma \4-2\ 

5 Discussion and Comparison with Related Work 

As mentioned in Sectional there are have been many papers studying the Russian cards problem and 
generalizations of it. Here we concentrate on recent work that takes a combinatorial approach [lj 

seiii]. 

Albert et al. [lj consider the card problem from both epistemic logic and combinatorial perspec- 
tives, establishing axioms CAl, CA2, and CA3 that are roughly equivalent to our requirements for 
a protocol to be informative and weakly 1-secure in the 7-equitable case. The difference is that the 
authors pQ treat security on the announcement level; that is, they identify various announcements 
as good if the relevant properties hold for any possible hand for Alice in the given announcement. 
No assumption is made that, for every possible hand for Alice, an announcement is defined, or 
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that a good announcement even exists. Our definitions, on the other hand, require that Alice have 
a (secure) announcement for every possible hand Ha € (^) . In particular, we argue that it is 
not possible to formally define or discuss the security of a scheme using definitions that focus on 
individual announcements. 

The authors [I] present several useful results, some of which we have cited in this paper, on the 
relationships between the parameters a and c, and b and c, as well as bounds on the minimum and 
maximum number of hands in a good announcement. The focus is on the level of announcements 
throughout: the authors argue that, to minimize information gained by Cathy, the size of the 
announcement should be maximized. Moreover, the authors show good announcements exist for 
some special cases, including using block designs for the case (a, 2,1), when a = 0,4 (mod 6) 
(corresponding to the Steiner triple systems), and using Singer difference sets for the case (a,b,c), 
where a and c are given, and b is sufficiently large. A few other small cases are also given. 

Atkinson and van Ditmarsch [3] extend these notions to include a new axiom, CA4, which 
roughly corresponds to our notion of perfect 1-security. That is, the authors recognize the possibility 
of card occurrence bias in a good announcement, which gives Cathy an advantage in guessing Alice's 
hand. Axiom CA4 introduces the requirement that, in the set of hands Cathy knows are possible 
for Alice, each card Cathy does not hold occurs a constant number of times. In this setting, the 
authors use binary designs to construct a good announcement (also satisfying CA4) for parameters 
of the form (2 k ~ 1 , 2 k ~ 1 — 1, 1), where k > 3. Atkinson and van Ditmarsch also consider the problem 
of unbiasing an announcement by applying a protocol that takes the existence of bias into account. 
An example of two possible methods for achieving this are given for the parameter set (3,3,1). 
We remark that our approach is much simpler and yields nice solutions for the (3, 3, 1) case. In 
particular, we require fewer announcements and thereby less communication complexity. 

Albert et al. [2j investigate both the problem of communicating the entire hand (or state infor- 
mation) and communicating a secret bit. In effect, their notion of card/state safe is similar to our 
notion of weak 1-security. The analysis includes a sum announcement protocol for the case (k, k, 1), 
where k > 3; that is, both players announce the sum of their cards modulo 2k + 1. In addition, 
Albert et al. show that state safe implies bit safe, and pose the interesting open question of whether 
a protocol for sharing a secret bit implies the existence of a protocol for sharing states/card deals. 

Cordon- Franco et al. [4] focus on the case c = 1, and present a protocol in which Alice and Bob 
announce the sum of their hands modulo a given (public) integer. The authors deal with the case 
of the modulus being either n (the size of the deck) or the least prime p larger than n, and show 
that, by choosing one of these protocols as appropriate, deals of the form (a, b, 1) are secure (in the 
weak 1-secure sense) and informative. That is, Alice and Bob learn each other's cards, but Cathy 
does not know any of Alice or Bob's cards afterwards. 

6 Conclusion and Open Problems 

We have presented the first formal mathematical presentation of the generalized Russian cards 
problem, and have provided rigorous security definitions that capture both basic and extended 
versions of weak and perfect security notions. Using a combinatorial approach, we are able to give 
a nice characterization of informative strategies having optimal communication complexity, namely 
the set of announcements must be equivalent to a large set of t — (n, a, l)-designs, where t = a — c. 
We also provide some interesting necessary conditions for certain types of deals to be simultaneously 
informative and secure. That is, for deals of the form (a, b,a — d), where b > d— 1 and the strategy 
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is assumed to be perfectly {d — l)-secure, we show that a = d + 1 and hence c = 1. Moreover, for 
informative and perfectly (d — l)-secure deals of the form [d + 1,6, 1) satisfying b > d — 1, every 
announcement must necessarily be a d — (n, d + 1, l)-design. 

There are many open problems in the area, especially for deals with c > 1. An interesting 
question is whether we can achieve generalizations of Theorems 13.111 and 13.81 without assuming 
(d — 1) security. That is, we wish to study the case of deals satisfying c > 1, where perfect 1- 
security holds. In particular, it is unclear if there even exist protocols that are simultaneously 
informative for Bob and perfectly 1-secure against Cathy for deals with c > 1. 
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